CVE-2020-11721: 
NixOS vulnerability analysis and mitigation

load_png in loader.c in libsixel.a in libsixel 1.8.6 has an uninitialized pointer leading to an invalid call to free, which can cause a denial of service. The vulnerability was discovered and disclosed on April 12, 2020, and is tracked as CVE-2020-11721. The vulnerability affects libsixel version 1.8.6 (NVD, CVE).

The vulnerability is characterized by an uninitialized pointer in the load_png function within loader.c of libsixel.a. When this pointer is passed to the free() function, it results in an invalid memory operation. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The weakness is classified as CWE-824 (Access of Uninitialized Pointer) (NVD).

The vulnerability can lead to a denial of service condition when exploited. The impact is primarily focused on system availability, with no direct impact on confidentiality or integrity. The CVSS scoring indicates high impact on availability while requiring user interaction (NVD).

The vulnerability has been fixed in versions after 1.8.6. According to the Debian Security Tracker, the fix has been implemented in newer releases of the package. Users are advised to upgrade to a patched version of libsixel (Debian Tracker).